Intel SGX Explained Victor Costan and Srinivas Devadas [email protected], [email protected] Computer Science and Artificial Intelligence Laboratory Massachusetts Institute of Technology ABSTRACT Data Owner’s Remote Computer Computer Intel’s Software Guard Extensions (SGX) is a set of Untrusted Software extensions to the Intel architecture that aims to pro- vide integrity and confidentiality guarantees to security- Computation Container Dispatcher sensitive computation performed on a computer where Setup Computation Setup all the privileged software (kernel, hypervisor, etc) is Private Code Receive potentially malicious. Verification Encrypted This paper analyzes Intel SGX, based on the 3 pa- Results Private Data pers [14, 79, 139] that introduced it, on the Intel Software Developer’s Manual [101] (which supersedes the SGX Owns Manages manuals [95, 99]), on an ISCA 2015 tutorial [103], and Trusts Authors on two patents [110, 138]. We use the papers, reference Trusts manuals, and tutorial as primary data sources, and only draw on the patents to fill in missing information. Data Owner Software Infrastructure This paper does not reflect the information available Provider Owner in two papers [74, 109] that were published after the first Figure 1: Secure remote computation. A user relies on a remote version of this paper. computer, owned by an untrusted party, to perform some computation This paper’s contributions are a summary of the on her data. The user has some assurance of the computation’s Intel-specific architectural and micro-architectural details integrity and confidentiality. needed to understand SGX, a detailed and structured pre- sentation of the publicly available information on SGX, uploads the desired computation and data into the secure a series of intelligent guesses about some important but container. The trusted hardware protects the data’s con- undocumented aspects of SGX, and an analysis of SGX’s fidentiality and integrity while the computation is being security properties. performed on it. SGX relies on software attestation, like its predeces- 1 OVERVIEW sors, the TPM [71] and TXT [70]. Attestation (Figure 3) Secure remote computation (Figure 1) is the problem proves to a user that she is communicating with a specific of executing software on a remote computer owned and piece of software running in a secure container hosted maintained by an untrusted party, with some integrity by the trusted hardware. The proof is a cryptographic and confidentiality guarantees. In the general setting, signature that certifies the hash of the secure container’s secure remote computation is an unsolved problem. Fully contents. It follows that the remote computer’s owner can Homomorphic Encryption [61] solves the problem for a load any software in a secure container, but the remote limited family of computations, but has an impractical computation service user will refuse to load her data into performance overhead [140]. a secure container whose contents’ hash does not match Intel’s Software Guard Extensions (SGX) is the latest the expected value. iteration in a long line of trusted computing (Figure 2) The remote computation service user verifies the at- designs, which aim to solve the secure remote compu- testation key used to produce the signature against an tation problem by leveraging trusted hardware in the endorsement certificate created by the trusted hardware’s remote computer. The trusted hardware establishes a se- manufacturer. The certificate states that the attestation cure container, and the remote computation service user key is only known to the trusted hardware, and only used 1 Data Owner’s Remote Computer Trusted Platform Computer Trusted Hardware AK: Attestation Key Data Owner’s Computer Endorsement Certificate Untrusted Software Secure Container Computation Secure Container Initial State A Dispatcher Key exchange: A, g Public Code + Data Setup Public Loader gA Computation A Setup Key exchange: B, g Private Code AB Receive B A B Shared key: K = g Verification Encrypted g , SignAK(g , g , M) Results Private Data M = Hash(Initial State) AB Shared key: K = g Builds EncK(secret code/data) Secret Code + Data Owns Authors Manages Trusts Computation Results EncK(results) Trusts Computation Results Data Owner Software Infrastructure Manufacturer Figure 3: Software attestation proves to a remote computer that Provider Owner it is communicating with a specific secure container hosted by a Trusts trusted platform. The proof is an attestation signature produced Figure 2: Trusted computing. The user trusts the manufacturer of a by the platform’s secret attestation key. The signature covers the piece of hardware in the remote computer, and entrusts her data to a container’s initial state, a challenge nonce produced by the remote secure container hosted by the secure hardware. computer, and a message produced by the container. for the purpose of attestation. improvements for enclave authors, it is a small incre- mental improvement, from a design and implementation SGX stands out from its predecessors by the amount standpoint. After understanding the principles behind of code covered by the attestation, which is in the Trusted SGX 1 and its security properties, the reader should be Computing Base (TCB) for the system using hardware well equipped to face Intel’s reference documentation protection. The attestations produced by the original and learn about the changes brought by SGX 2. TPM design covered all the software running on a com- puter, and TXT attestations covered the code inside a 1.1 SGX Lightning Tour VMX [181] virtual machine. In SGX, an enclave (secure SGX sets aside a memory region, called the Processor container) only contains the private data in a computation, Reserved Memory (PRM, x 5.1). The CPU protects the and the code that operates on it. PRM from all non-enclave memory accesses, including For example, a cloud service that performs image pro- kernel, hypervisor and SMM (x 2.3) accesses, and DMA cessing on confidential medical images could be imple- accesses (x 2.9.1) from peripherals. mented by having users upload encrypted images. The The PRM holds the Enclave Page Cache (EPC, users would send the encryption keys to software running x 5.1.1), which consists of 4 KB pages that store enclave inside an enclave. The enclave would contain the code code and data. The system software, which is untrusted, for decrypting images, the image processing algorithm, is in charge of assigning EPC pages to enclaves. The and the code for encrypting the results. The code that CPU tracks each EPC page’s state in the Enclave Page receives the uploaded encrypted images and stores them Cache Metadata (EPCM, x 5.1.2), to ensure that each would be left outside the enclave. EPC page belongs to exactly one enclave. An SGX-enabled processor protects the integrity and The initial code and data in an enclave is loaded by un- confidentiality of the computation inside an enclave by trusted system software. During the loading stage (x 5.3), isolating the enclave’s code and data from the outside the system software asks the CPU to copy data from un- environment, including the operating system and hyper- protected memory (outside PRM) into EPC pages, and visor, and hardware devices attached to the system bus. assigns the pages to the enclave being setup (x 5.1.2). At the same time, the SGX model remains compatible It follows that the initial enclave state is known to the with the traditional software layering in the Intel archi- system software. tecture, where the OS kernel and hypervisor manage the After all the enclave’s pages are loaded into EPC, the computer’s resources. system software asks the CPU to mark the enclave as This work discusses the original version of SGX, also initialized (x 5.3), at which point application software referred to as SGX 1. While SGX 2 brings very useful can run the code inside the enclave. After an enclave is 2 initialized, the loading method described above is dis- After having reviewed the background information, abled. section 5 provides a (sometimes painstakingly) detailed While an enclave is loaded, its contents is cryptograph- description of SGX’s programming model, mostly based ically hashed by the CPU. When the enclave is initialized, on Intel’s Software Development Manual. the hash is finalized, and becomes the enclave’s measure- Section 6 analyzes other public sources of informa- ment hash (x 5.6). tion, such as Intel’s SGX-related patents, to fill in some A remote party can undergo a software attestation of the missing details in the SGX description. The sec- process (x 5.8) to convince itself that it is communicating tion culminates in a detailed review of SGX’s security with an enclave that has a specific measurement hash, properties that draws on information presented in the and is running in a secure environment. rest of the paper. This review outlines some troubling Execution flow can only enter an enclave via special gaps in SGX’s security guarantees, as well as some areas CPU instructions (x 5.4), which are similar to the mech- where no conclusions can be drawn without additional anism for switching from user mode to kernel mode. information from Intel. Enclave execution always happens in protected mode, at That being said, perhaps the most troubling finding in ring 3, and uses the address translation set up by the OS our security analysis is that Intel added a launch control kernel and hypervisor. feature to SGX that forces each computer’s owner to gain To avoid leaking private data, a CPU that is executing approval from a third party (which is currently Intel) for enclave code does not directly service an interrupt, fault any enclave that the owner wishes to use on the com- (e.g., a page fault) or VM exit.